Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 1 of 3 | January 2018

Contract Compliance and Audit Volume 1

Recommendation 13: Increase coverage of the effectiveness of contractor 

internal control audits by leveraging IPAs.

Problem

In recent years, DoD has not provided sufficient reviews and audits of contractor business systems that 

would satisfy the DFARS Business Systems requirements under DFAR clause 252.242-7005. 

Background

As shown in the chart below, the coverage varies by business system, but no system is receiving 

extensive coverage. The lack of coverage of these systems prevents DoD from obtaining assurance that 

contractors’ business systems have effective controls and can be relied on when deciding what to 

review or audit and how much substantive test of details to perform. The absence of assurance causes 

auditors to consider most areas high risk resulting in less efficient and less timely audits.

Findings

The deficiency reports shown in the chart below indicate the system has a significant deficiency. 

Currently the identification of significant deficiencies almost always occurs in a nonsystem audit. 

During a nonsystem audit, an alleged finding is identified and a determination is made that the finding 

results from weak internal controls within the business system. In this current scenario, DoD only 

becomes aware of business system vulnerabilities when a significant deficiency already has occurred. 

By obtaining positive assurance of the system’s effectiveness, an opportunity exists to prevent or 

correct vulnerabilities before there is any adverse effect on DoD interests.

Table 2-6. DCAA Business System Coverage1

Type of System Approximate

Total Systems 2016 Audits % of 2016Coverage

Accounting 3,786 8 0.2%

MMAS 373 7 1.9%

Estimating 774 7 0.9%

Business System Deficiency Reports 78

Conclusions

Obtaining timely assurance that defense contractors have effective internal controls is an essential 

component of all cost-effective compliance frameworks. Timely audits of controls can prevent or 

resolve problems before they become significant. Having a recent assessment is a critical part of the risk 

model stated in Recommendation 14, and confirming effective internal controls exist will permit all 

 

1 Data under “Total Systems” is from DCMA CBAR and was provided to the Section 809 Panel by DCAA. The data in the other two columns 

is from DCAA, email to Section 809 Panel Staff, December 18, 2017.
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 1 of 3 | January 2018

Contract Compliance and Audit Volume 1

additional contract audits to be performed more efficiently and timely. However, none of the benefits 

can currently be attained because adequate coverage has not been accomplished in several years.

Implementation

Legislative Branch

§ No statutory changes are required.

Executive Branch

§ Revise DFARS 242.7501(a) to define auditor for the purpose of permitting contracting officers to 

rely on the work of an IPA to determine the adequacy of a contractor’s accounting system. 

Implications for Other Agencies

§ There are no cross-agency implications for this recommendation.